Skip to content

Unify the minimum TLS version of DoH and DoT #517

Closed
@PeterDaveHello

Description

Currently, TLS 1.0 and TLS 1.1 is not offered by blocky's DoT implementation, but offered by blocky's DoH implementation.

As DoH and DoT are both still something new, and there're security concerns about TLS < 1.2, maybe should unify both of their minimum TLS version to v1.2 here?

Using testssl.sh(https://github.com/drwetter/testssl.sh) to test the TLS version.

On https port:

 Testing protocols via sockets except NPN+ALPN 

 SSLv2      not offered (OK)
 SSLv3      not offered (OK)
 TLS 1      offered (deprecated)
 TLS 1.1    offered (deprecated)
 TLS 1.2    offered (OK)
 TLS 1.3    offered (OK): final
 NPN/SPDY   not offered
 ALPN/HTTP2 h2, http/1.1 (offered)

On TLS port:

 Testing protocols via sockets except NPN+ALPN 

 SSLv2      not offered (OK)
 SSLv3      not offered (OK)
 TLS 1      not offered
 TLS 1.1    not offered
 TLS 1.2    offered (OK)
 TLS 1.3    offered (OK): final
 NPN/SPDY   not offered
 ALPN/HTTP2 not offered

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Assignees

No one assigned

    Labels

    Projects

    No projects

    Milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions